3.6.32 · D1Spacecraft Structures & Systems Engineering

Foundations — Redundancy — cold standby, hot standby, active redundancy

2,377 words11 min readBack to topic

Before you can read the parent note on cold/hot/active redundancy, you need every symbol it throws at you built from nothing. We go one brick at a time. Nothing below assumes you have seen probability, exponentials, or calculus before.


1. Reliability — the survival chance

The picture: imagine identical radios all switched on at the same moment. As hours pass, some die. If after hours still work, then .

Figure — Redundancy — cold standby, hot standby, active redundancy

Why the topic needs it: every claim like "two units are more reliable than one" is a claim about . Look at the curve in the figure — it starts at (all alive at ) and slides toward . Redundancy is the art of pushing that curve to the right so it stays high for longer.


2. Failure rate — how fast things break

The picture: think of as the steepness of the death slide. A cheap part has a steep slide (large , dies fast); a space-grade part has a gentle slide (tiny ).

Why this tool and not another? We use a single constant because, for electronics in their useful mid-life, the risk among survivors stays roughly steady — a chip that has lasted 1000 hours is no more likely to die in its next hour than a fresh one. That "memoryless" behaviour is exactly what a constant captures, and it is what makes the tidy formulas in the parent note possible.


3. The exponential — why survival decays this shape

The picture: it is the death slide of Section 1, written as a formula. See the figure below where a big (coral) drops fast and a small (mint) drops slowly.

Figure — Redundancy — cold standby, hot standby, active redundancy

Why the topic needs it: every reliability formula in the parent — , , — is built by combining copies of . Master this one building block and the rest is arithmetic.

Recall Quick check: what is

for any component? . At time zero everything is alive. :::


4. "Probability it has failed" — the complement

Why the topic needs it: hot standby fails only when both units are dead. To compute "both dead" we first need "one is dead", which is exactly this complement. Hold onto the phrase: dead-chance .


5. Combining independent chances — multiply

The picture: think of a grid of outcomes. If A fails in of columns and B fails in of rows, the "both fail" corner is of the whole square.

Why this tool and not addition? We multiply, not add, because we want the overlap ("A dead AND B dead"), not the total ("A dead OR B dead"). This is the single most important move in the hot-standby derivation: system reliability .


6. MTTF and the integral

The picture: in the figure the shaded lavender region is the MTTF. A curve that stays high longer encloses more area — more average life. That is redundancy, geometrically.

Figure — Redundancy — cold standby, hot standby, active redundancy

The gentler the death slope (small ), the longer the average life — which matches intuition perfectly.


7. Choosing among outputs — voting and the majority

The picture: three arrows point to a value; two point to "5", one points to "9". The voter picks "5" and throws away the outlier. One liar cannot outvote two truth-tellers.

Why the topic needs it: active redundancy (Triple Modular Redundancy) never switches anything off — it simply masks a wrong output by out-voting it. This is a different survival strategy from standby, and it connects to Byzantine Fault Tolerance when a faulty unit lies inconsistently, and to Single Event Upset (SEU) as a common cause of a single wrong bit.


Prerequisite map

Reliability R of t = survival chance

Dead-chance = 1 minus R

Failure rate lambda

Exponential e to minus lambda t

Multiply rule for both dead

Hot and cold standby reliability

MTTF = area under R

Voting and choose k of n

Active redundancy TMR

Redundancy topic 3.6.32

Every arrow above is a "you must understand this before that". Trace any path and you can read the parent note top to bottom.

Related building blocks live in Power Budget (why hot standby's always-on cost matters), Failure Modes and Effects Analysis (FMEA) and Fault Detection and Isolation (how failure gets noticed before a switchover can happen). The parent topic is the redundancy note.


Equipment checklist

Cover the right side and answer each before opening the parent note.

  • What does mean in plain words? ::: The probability a component is still working after running for time ; a number from to .
  • What range does the time variable take? ::: — elapsed running time from launch, never negative.
  • What is , precisely? ::: The instantaneous hazard rate — the fraction of currently surviving units that die per hour, not a plain count of failures per hour.
  • What does mean? ::: An infinitesimally small slice of time (a duration shrunk toward zero).
  • What differential equation governs single-unit reliability, and what is its solution? ::: , solved by .
  • What is for any unit? ::: — at launch nothing has failed yet.
  • What is the chance a unit has failed by time ? ::: , the complement of the survival chance.
  • Why do we multiply by itself for two units? ::: To get "both dead" — the multiply rule for independent events gives the overlap of both failing.
  • What does mean in ? ::: Not a number, but "let grow forever"; safe because decays to zero fast enough for a finite total.
  • What does compute, and what does it look like? ::: The MTTF (average lifetime); geometrically it is the area under the survival curve.
  • What is MTTF for a single unit, and how is the integral done? ::: , from .
  • What does mean and what is its formula? ::: The number of ways to choose of items; .
  • What does majority() do? ::: Outputs whatever at least two of the three units agree on, ignoring the outlier.